Recently active topics

How can we prevent a single workstation from causing an organization-wide DNS outage through FortiGate IPS quarantine?We recently experienced an incident where FortiGate IPS detected DNS.Pointer.Loop traffic originating from workstation. The automated quarantine action affected both of our DNS/Domain Controller servers, resulting in a DNS connectivity outage across the organization.We manually unbanned the servers, which restored services, and traced the related DNS activity back to the originating workstation.Our concern is that a single endpoint, whether due to malware, misconfiguration, or a user changing network settings, could trigger an automated security response that impacts critical infrastructure.What would be the recommended FortiGate configuration or best practice to prevent this from happening again?

DescriptionThis article describes how to back up and restore FortiAuthenticator via the REST API using the open-source automation tool Ansible.ScopeFortiAuthenticator.SolutionThis article assumes that the FortiAuthenticator REST API is enabled and Ansible is installed in control node. Refer to the community article Technical Tip: Enable FortiAuthenticator REST API for details on how to get web service access enabled for an administrator account and get an API access key.Three files will be created to demonstrate how Ansible could be used to back up and restore FortiAuthenticator configuration:Hosts: Inventory file, containing a list of FortiAuthenticators, account names, and API access keys.Backup.yaml: Playbook to back up FortiAuthenticator configuration.Restore.yaml: Playbook to restore FortiAuthenticator from a backup file.Create the Ansible inventory file named hosts. The device group FortiAuthenticators contains a list of FortiAuthenticator addresses. Each FortiAuthenticator may h

Hello,i have a FortiSwitch running at 7.2.9. There we have a trunk with no name.We want to delete this trunk.Because the name is the reference for every command, we don’t have any possibility.config switch trunk       edit ""        set mode lacp-active        set auto-isl 1        set members "port24"    nextIs there another way to delete this trunk?Thanks

Hello, I apologize in advance if this sounds like a stupid question. I passed the NSE4 Certification Exam on June 18, 2024. I very recently heard that my certification would run out of validity if it’s 2 years old. I have to take the NSE5 Certification Exam, as I was unable to take it before, but I am unsure if my NSE4 Certification is still valid. Please let me know and thanks for your help!

Hey, currently learning for my certification and got really stuck on this question: So why would Change Inspection mode to Flow-Based - as the Training Portal says - be the right answer here? As i understood from the Study Guide the Application Control relys on the IPS Engine and will always work in Flow-based even if the Firewall Policy has Proxy-based Inspection configured. So it should not matter which Inspection-Mode is configured from my understanding. As the phrase from the study guide says:  Also, i tried to reproduce it on my lab. Looked for some Google Application which falls under Excessive Bandwith, in this scenario I choosed Google.Maps. Put this object into Application and Filter Overrides with Prio 2 and Action Monitor and above the Excessive-Bandwith Filter with Prio 1 and Action Block. Google Maps got blocked. When moving Google-Maps to Prio 1 the connection worked. So is this maybe wrong in the Training Portal? Or where am I thinking wrong? Rea

How to configure an event handlers that alert when config change happened after working hours in fortianalyzer 7.6.7

DescriptionThis article describes how to configure an IPsec VPN Tunnel using IKE v2 in FortiClient.ScopeFortiClient, FortiGate.SolutionThe FortiGate IPsec tunnels can be configured using IKEv2.  This document provides an example of configuring IPsec VPN connectivity using a local user defined on the FortiGate device.For detailed instructions on creating local users, remote users, or user groups, refer to the following Fortinet documentation:UsersUser groups Summary of the FortiGate GUI configuration:  The following commands need to be applied manually via CLI; these are needed for IKEv2 user authentication: config vpn ipsec phase1-interface     edit "Dialup"         set eap enable         set eap-identity send-request         set authusrgrp "Test"     next end Starting from FortiOS 7.6.1, enabling EAP and specifying the User group within the IPsec VPN tunnel can be configured directly via the Graphical User Interface (GUI). These options are available under VPN -> VPN Tunnels ->

Hi,I have a SonicWall NSA (site A) connected to Fortigate (site B) with IPSec Tunnel. Site A sends ping probes over the tunnel interface to site B's WAN IP. The Sonicwall configures implicit probes when configurating the IPSec tunnels in virtual SD-WAN configuration. Debug flow revealed "reverse path check fail, drop" due to strict RPF, so I configured a DNAT policy with Virtual IP as below. This got me passed the RPF check but when enabling below policy the CLI command does not responds normally for some reasons so I must be doing something wrong. Any suggestions? config firewall vipedit "vpn-hub-probe-vip"set uuid 3e958d92-4f6b-51f0-67e8-xxxset extip 217.91.x.x                         (local WAN Interface IP)set mappedip "192.168.10.1"           (LAN interface IP)set extintf "any"nextend Firewall Policyedit 24set status disableset name "TEST"set uuid 20025a9c-4f6e-51f0-1a3d-x

Hello everyone,We are experiencing a minor but frustrating issue with our FortiAuthenticator, and I would appreciate some guidance.Our FortiAuthenticator is configured to synchronize users from Active Directory (AD/LDAP). Under Synchronization Attributes, we have selected Local User for the Sync as option.As a result, whenever a new user is created in AD and synchronized with FortiAuthenticator, the system automatically generates a unique random password and sends it to the user via email.Our goal is to disable this automatic password notification email without affecting the existing AD synchronization or user authentication process.I have searched through the documentation and configuration settings but haven't found a way to disable this specific email notification.The only workaround I have identified so far is modifying the following Replacement Message:Admin Set Random Password for User Email MessageHowever, this would only change the email content rather than prevent the email fr

DescriptionTake these actions when a admin user on FortiPAM is lost or locked out.ScopeFortiPAM.SolutionPossibilities of failure:In some scenarios, due to security hardening, all of the admin users are required to use MFA. Issues encountered with MFA may prevent access to the FortiPAM GUI.In some scenarios, this is because the admin/superadmin credentials are misplaced.Recommendations:Always assign a super administrator access to the required policies with an access profile.For the default super administrator user, do not configure any MFA in order to avoid lockouts.If access is still possible for the super administrator, see Troubleshooting Tip: Password change for admin account with superadmin credentials.If access is no longer possible, there is no possible way to reset the admin password from the existing configuration. Use the workaround below instead.Deploy a new FortiPAM virtual machine.Create a superuser account on the new virtual machine without MFA enabled.Restore the configu

DescriptionA solution for Web Secrets' session disconnection when Session Recording is enabled.ScopeFortiPAM.SolutionIn this scenario, the web secret launches as expected while Session Recording is disabled in the required secret settings.However, when Session Recording is enabled, the launcher stops working with the following error:To troubleshoot this issue, verify that sufficient disk storage is available for video recordings. Disk usage can be checked from the FortiPAM GUI under Log & Report -> Disk Usage.Additionally, the disk allocation can be verified from the CLI using the following command:execute disk listIf no disk is allocated for video storage and only the log partition is present, Session Recording cannot write the recording data. In this scenario, WEBRDP sessions may terminate when Session Recording is enabled because no storage location is available for video files.To resolve the issue, add an additional storage disk to the FortiPAM virtual machine (Hyper-V deplo

DescriptionA fix for a FortiWeb graphical user interface issue that limits the Header Value field to 255 characters in custom rules.ScopeFortiWeb versions 7.6.x and 8.0.x.SolutionWhen configuring a custom access rule in the FortiWeb graphical user interface, the Header Value field shows the error message "Please enter no more than 255 characters". This limitation prevents the use of long Regular Expressions (RegEx) for fields such as User-Agent, parameter, or user.This issue is only happens with the FortiWeb's graphical user interface (GUI), no matter which browser is used, while the command line interface (CLI) allows up to 1023 characters.To solve this, use the CLI to configure the custom rule, as the CLI supports a character limit of up to 1023 characters for the header-value field.Access to the FortiWeb CLI and run the following commands to configure the custom access rule with the desired long header value:config waf custom-access rule edit "CustomRule_Name" config http-h

DescriptionA technical solution to resolve handshake errors encountered when using FortiAppSec Cloud.Users experience an error message indicating that the handshake was canceled when attempting to access a specific application through FortiAppSec Cloud, and this article provides a solution.ScopeFortiAppSec Cloud.SolutionA handshake error may occur because the origin server supports HTTP/2, but HTTP/2 is not enabled in the FortiAppSec Cloud configuration. When traffic passes through FortiAppSec Cloud without HTTP/2 enabled, the connection falls back to HTTP/1.1, which causes the origin server to cancel the handshake.To resolve the handshake error, follow these steps:Enable HTTP/2 on both endpoints and origin servers in FortiAppSec Cloud. This can be done by going to Endpoints -> Advanced Security and Protocol Settings -> HTTP/2:Under Origin Servers -> HTTP/2, select the Enable option:Next, verify that the server supports HTTP/2. This can be done using a tool such as curl to ens

DescriptionLearn best practices for firmware upgrades in FortiWeb HA scenarios.ScopeFortiWeb (Hardware appliances, virtual machines, cloud environments).SolutionFor FortiWeb HA pair firmware upgrades, the documented best practices are:Confirm the HA member health before starting:Verify both HA members are powered on.Verify they are available on all configured network interfaces.This helps prevent HA port monitoring from triggering an unintended failover and causing traffic interruption during the upgrade.Prepare a checklist with all related FortiWeb services:The checklist must be checked before and after the upgrade procedure.The list should include services like:FortiWeb administrative access.Published web applications.HA failover and primary-secondary switching.Perform the upgrade from the primary appliance:Log in to the web UI of the primary appliance.Use:The admin account, orAn administrator account with both Read and Write permissions in the Maintenance categoryUpgrade using the n

Hi everyone,Is anyone managing FortiExtender devices through FortiGate?I currently have a FortiExtender managed by a FortiGate, and I'm trying to monitor it using Zabbix via SNMP, with the FortiGate acting as the monitoring point.Has anyone successfully implemented this setup? Is it possible to retrieve FortiExtender metrics through the FortiGate using SNMP?Any advice or experience would be greatly appreciated!Thanks in advance!

I configured Multi-Connect in the endpoint profile so that users could automatically connect to two tunnels (SASE and On-Premise). I entered the required information, but the tunnel isn't establishing. Has anyone else experienced this?What I found curious is that in FortiSASE, there's no option to enter the Phase 1 and Phase 2 tunnel information.

DescriptionThis article describes how to recover the RADIUS or TACACS+ secret key via the FortiGate CLI.ScopeFortiOS.SolutionIf the secret key for a RADIUS or TACACS+ server is forgotten, it is possible to view the decrypted form by querying the FortiGate's API.The query will be done with '?plain-text-password=1', similar to what is done to see the IPsec PSK:Technical Tip: Use the FortiGate API to recover an IPsec pre-shared key in plain text format.The correct path to query for RADIUS would be as follows:https://[FortiGate IP]/api/v2/cmdb/user/radius/[RADIUS server name]?plain-text-password=1This is the output without '?plain-text-password=1', the secret is encrypted:This is the output with '?plain-text-password=1', the secret is visible:The correct path to query for TACACS+ would be as follows:https://[FortiGate IP]/api/v2/cmdb/user/tacacs+/[TACACS+server name]?plain-text-password=1Encrypted output:Decrypted output:The secondary server's secret will NOT be visible with this method, b

Description This article describes how to configure FortiGate to forward SYSLOG messages to FortiNAC so that FortiNAC can detect new devices connected to a FortiSwitch, using FortiSwitch event logs MAC_ADD, MAC_DEL, and MAC_MOVE. Scope FortiGate, FortiSwitch, FortiNAC. Solution On FortiGate, configure the FortiNAC IP address as a SYSLOG server.   config log syslogd setting     set status enable     set server <FortiNAC IP> end   For more information about configuring SYSLOG on FortiGate, see the article: Technical Tip: How to configure syslog on FortiGate   To send only the required messages, a SYSLOG filter must be configured.   The required log messages are:   LOG_ID_FGT_SWITCH_MAC_ADD LOG_ID_FGT_SWITCH_MAC_DEL LOG_ID_FGT_SWITCH_MAC_MOVE   To configure the SYSLOG filter:   config log syslogd filter     set forward-traffic disable     set local-traffic disable   &nbsp

Ladies and Gents,I have 2 FortiSwitch 224D and would like to connect it to a FGT 40F, what is the recommended configuration for this setup?Thanks in advanced!Alfred

DescriptionThis article describes an issue where an Automation Stitch triggered by a 'FortiAnalyzer Event Handler' does not correctly pass the variable to other FortiGate devices in a Security Fabric. As a result, the Action CLI Script failed due to variable is not populated.ScopeFortiGate.SolutionIn this scenario, an Automation Stitch is configured to quarantine the source IP address using the following command:diagnose user banned-ip add src4 %%log.srcip%% 30 adminWhen the associated FortiAnalyzer Event Handler is triggered, the Automation Stitch executes; however, the %%log.srcip%% variable is not replaced with the actual source IP address.As a result, the command is executed with the unresolved variable and fails with the error 'Invalid IP address format'.Network Topology:FortiGate VM --------> FortiAnalyzer VMFortiGate 200G ------> FortiAnalyzer VMConfiguration:FortiGate VM on FortiOS 7.6.7 (Fabric Root):Navigate to Security Fabric -> Fabric Connectors -> Right Click '

Hi guys,I have FortiGate VM 7.6.6 on windows 10 with Hyper V &  FortiSwitch 124F 7.6.6I configured Software switch with Fortilink and following this KBi have enabled MAC spoofing on the Hyper V VM networkso when I connect the Fortiswitch to my computer its receiving DHCP, then I authorize  it on the FortiGateat first it seems that Fortilink is up and after a few seconds its down and I also no longer have ping to the Fortiswitch this is my interface settings config system switch-interface    edit "FortiLink2"        set vdom "root"        set member "port2"    nextendconfig system interface    edit "FortiLink2"        set vdom "root"        set fortilink enable        set ip 10.200.0.1 255.255.255.0        set allowaccess ping fabric        set type switch        set lldp-reception enable        set lldp-transmission enable        set snmp-index 15        set switch-controller-nac "FortiLink2"        set switch-controller-dynamic "FortiLink2"    nextendI would appreciate it if someo

Is it possible to Gre over Dynamic IPsec between Fortigate & mikrotik.Can any one give me configuration sample for gre over dynamic ipsec for fortigate firewall?

DescriptionThis article describes how to place unregistered endpoints in a Registration VLAN and allow registered endpoints onto the production network. It covers the selector-based configuration in 7.6.7 and the legacy configuration in 7.4.4.ScopeFortiNAC-F 7.6.7 and 7.4.4.SolutionThis example uses wired RADIUS MAC authentication with the following VLANs:Endpoint statusVLANRogue / unregisteredRegistration — VLAN 11Registered and normal, with no overriding policyProduction — VLAN 77Before starting, confirm that RADIUS authentication and dynamic VLAN assignment are configured on the switch. Both VLANs must be available, and the Registration network must provide the required DHCP, DNS, and portal access.FortiNAC-F v7.6.7 — Selector-based configuration:For upgraded systems, confirm that the test device has Device Legacy Mode set to OFF. Do not disable Global Legacy Mode just for testing; that change is irreversible.See: FortiNAC-F 7.6.7 - Device Migration Guide - Support for RADIUS-only D

Hello,I have a new setup with one Fortigate 70g and 2 FortiAP FAP-243K.The Fortigate is configured in Transparent mode and evreything with a fixed ip in the same subnet/vlan. Everything is on the latest firmware.When connected on 2 ports of the Fortigate, the 2 AP are working perfectly (Bridge mode SSID) but when I try to chain the second AP on the lan port 2 of the first AP it appears in the LDDP but never come online under the Managed FortiAP.Time is ok and synchronized. Une the AP profile the LAN port is set as Uplink and Bridge, Bridge to LAN. Does anybody have an idea please? ThanksFred

DescriptionThis article describes the issue where FortiGate GUI access is not working in firmware version 7.6.4 and above.ScopeFortiGate.SolutionAfter upgrading to firmware version 7.6.4 or above, the GUI may display an 'ERR_CONNECTION_REFUSED' error as shown in the image below:In the sniffer output below, it is possible to see that the firewall is sending the RST packet in response to the SYN (connection initiation).  diagnose sniffer packet any "host 10.2.2.1 and port 443 " 4 0 l interfaces=[any] filters=[host 10.2.2.1 and port 443 ] 2026-02-04 14:38:20.133931 port1 in 10.2.2.1.58189 -> 10.1.1.1.443: syn 3366770127 2026-02-04 14:38:20.134024 port1 out 10.1.1.1.443 -> 10.2.2.1.58189: rst 0 ack 3366770128 2026-02-04 14:38:20.387212 port1 in 10.2.2.1.63535 -> 10.1.1.1.443: syn 3710423967 2026-02-04 14:38:20.387296 port1 out 10.1.1.1.443 -> 10.2.2.1.63535: rst 0 ack 3710423968In FortiOS v7.6.4 and above, a new internal daemon, 'http_authd', is responsible for centralized GUI